THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

Recommendations

Info

Destover “Volgmer2” SSL remote server names contained in Client Hello ad.naver.com all.baidu.com www.amazon.com www.apple.com www.bing.com www.dell.com www.hp.com www.microsoft.com www.oracle.com www.paypal.com www.uc.com www.yahoo.com (Note that domain names included in Destover SSL handshakes are legitimate and used only as disguise.)
APPENDIX: <strong>THE</strong> MICROS<strong>OF</strong>TCODESIGNINGPCA SELF-SIGNED SAMPLE CLUSTER Group: 03c64293830f4c8f43666b3901d02332 87bae4517ff40d9a8800ba4d2fa8d2f9df3c2e224e97c4b3c162688f2b0d832e KorDllbot v1.1 backdoor service, listening on port 179 Group: 3d348a74aab5359d422da7fad24b8c2c a7d088bf3ae2a82f711f816922779ac7b720170298ac43c76cf8c6e1aa8dfadd Proxymini 0.2.1, Luigi Auriemma fd95e095658314c9815df6a97558897cb344255bd54d03c965fa4cbd16d7bafd NoiseSin data stealer 82169a2d8f15680c93e1436687538afa01d6a2ecfe7a7cb613817c64a1a82342 NoiseSin data stealer 792b484ac94f0baefc7e016895373ba92c2927e3463f62adb701ddbe4c90604c KorDllbot backdoor (Unobfuscated API loading) 162d6223c1c1219ca81a77e60e6b776058517272fe7cac828a3f64dcacd87811 KorDllbot backdoor (XOR-obfuscated API loading) 56e0b1794a588e330e32a10813cdc9904e472c55f17dd6c8de341aeaf837d077 Keylogger c16a66c1d8e681e962f03728411230fe7c618b7294c143422005785d3a724ec4 Dropper for 162d6223c1c1219ca81a77e60e6b776058517272fe7cac828a3f64dcacd87811 57b4c2e71f46fe3e7811a80d19200700c15dd358bdf9d9fdf61f1c9a669f7b4b NoiseSin data stealer Group: 09b075a5393e93a3479a00051714de52 2d9edf45988614f002b71899740d724008e9a808efad00fa79760b31e0a08073 Joanap backdoor and SMB worm 006e0cc29697db70b2d4319f320aa0e52f78bf876646f687aa313e8ba04e6992 Joanap backdoor and SMB worm dda136bc51670e57a4b2f091f83ab7b44291a9323d5483abd9e91b78221e027f Data harvester Group: 17522941a80c25ab4c9cfe5f28d9361f 163571bd56001963c4dcb0650bb17fa23ba23a5237c21f2401f4e894dfe4f50d SMB worm and backdoor dropper for f901083da11222e3221f5d3e5d5f79d7ea3864282ea565e47c475ad23ef96ff4 Group: 9d0550e00b6d5da9407e28bca4336cc9
Page 1 and 2:
FROM SEOUL TO SONY: THE HISTORY OF
Page 3 and 4:
INTRODUCTION Much has been written
Page 5 and 6:
MALWARE ARCHEOLOGY As research into
Page 7 and 8:
THE KORDLLBOT BACKDOOR FAMILY KorDl
Page 9 and 10:
THE MicrosoftCodeSigningPCA CERTIFI
Page 11 and 12: KORDLLBOT-RELATED SMB WORMS The mal
Page 13 and 14: THE DOZER (AKA 7.7 DDOS) ATTACK The
Page 15 and 16: THE JOONGANG ILBO ATTACK In 2012, t
Page 17 and 18: THE KORHIGH MALWARE The Korhigh mal
Page 19 and 20: File timestamp matching function co
Page 21 and 22: NOV 2014: SONY ATTACK DESTOVER BACK
Page 23 and 24: THE KIMSUKY SYSTEM The Kimsuky malw
Page 25 and 26: WORKS CITED 1. FBI. FBI Liaison Ale
Page 27 and 28: APPENDIX: TECHNICAL DETAILS Note: D
Page 29 and 30: JOANAP.B WORM, OCT 2009 This malwar
Page 31 and 32: JOANAP.C BACKDOOR, JUL 2010 The ins
Page 33 and 34: JOANAP.E WORM, AUG-SEP 2011 Joanap.
Page 35 and 36: THE DESTOVER FAMILY DESTOVER “B07
Page 37 and 38: DESTOVER “WINDOWSUPDATETRACING”
Page 39 and 40: Since we know the XOR key used, we
Page 41 and 42: DESTOVER “B8AC0905” BACKDOOR, M
Page 43: DESTOVER “DUUZER” BACKDOORS, MA
Page 46 and 47: Decoy documents used by the “e400
Page 48 and 49: DESTOVER “BASICHWP” BACKDOOR, S
Page 50 and 51: DESTOVER “VOLGMER2” BACKDOOR, J
Page 52 and 53: APPENDIX: ALGORITHMS AND OTHER INDI
Page 54 and 55: XOR-XX-SUB-XX obfuscation This is a
Page 56 and 57: DB-SUB API Obfuscation This is a fo
Page 58 and 59: Intbox encoding This encoding is us
Page 60 and 61: KorDllbot / Joanap AES keys “Bb10
Page 64 and 65: 3d2a7ea04d2247b49e2dcad63a179ae6a47
Page 66 and 67: 6d5d706f5356e087f5961ba2ed808c51876
Page 68 and 69: APPENDIX: MALWARE HASHES KorDllbot-
Page 70 and 71: Destover “b076e058” samples Dro
Page 72 and 73: Destover “Duuzer” samples X86 s
Page 74 and 75: APPENDIX: C&C DATA Joanap-related C
Page 76 and 77: Destover “Duuzer” C&C IP addres
Page 78: ule DarkSeoul_Obf_Caracachs : Backd
show all

THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?